Tonight, where's the jazz?
The detailed, plain-English version of how JazzNode protects your data.
Last updated: April 14, 2026
JazzNode exists so that musicians, venues, and fans can trust a single source for the shows that matter. That trust is built on three principles: minimize what we hold, ride on audited infrastructure, and be honest about what we have and haven't done.
We are not a large company. We don't pretend to be one. Instead, we build on providers that have passed the audits large enterprises require, so the same guarantees apply to your data here.
JazzNode runs on a small number of carefully chosen providers. Each maintains independent third-party audits:
All traffic to and from JazzNode is encrypted with TLS 1.2 or higher. HTTP Strict Transport Security (HSTS) is enabled across all JazzNode domains.
Data at rest is encrypted by our infrastructure providers using AES-256 (Supabase, AWS S3, Vercel).
Ticket QR codes use signed tokens that cannot be forged or replayed by third parties.
Users authenticate via email/password (hashed with bcrypt by Supabase Auth) or Google OAuth 2.0. JazzNode never stores plaintext passwords or Google credentials.
Internal operations are partitioned into Owner, Admin, and Editor roles. Sensitive actions — refunds, payouts, data export, account deletion — require elevated roles and are logged.
Row Level Security (RLS) is enforced at the database layer. Even if an application bug were introduced, the database would reject unauthorized reads and writes.
We collect what's needed to operate the service: account basics, events you buy tickets to, messages you send through the platform. Card data, Google passwords, and device biometrics are never stored by JazzNode.
Accounts can be deleted on request, with personal data removed within 30 days, except where retention is required by law (e.g., tax records for ticket sales).
See the Privacy Policy for the full breakdown.
Production secrets live in Vercel's encrypted environment variable store. Preview, development, and production environments are fully isolated.
Cloud-to-cloud authentication uses OIDC tokens with short lifetimes. No long-lived credentials are committed to source control.
Internal tooling access is reviewed and revoked when team members change roles or leave.
Runtime errors and anomalies are monitored via Vercel Observability and Supabase logs. Security-relevant events are flagged for review.
If an incident affects your data, we will notify affected users within 72 hours of confirmation, in line with GDPR Article 33 expectations.
Backups and point-in-time recovery are in place for the production database.
If you believe you've found a security vulnerability, please email security@jazznode.com.
We commit to:
In scope: jazznode.com, *.jazznode.com, JazzNode iOS & Android apps. Out of scope: denial-of-service attacks, social engineering, physical attacks, and any research that degrades service for other users.
GDPR: EU users have the right to access, correct, export, and delete their data. Our processors support EU data residency and standard contractual clauses.
Taiwan PDPA (個人資料保護法): 娛興喂有限公司 operates JazzNode in Taiwan under the Personal Data Protection Act.
Taiwan Consumer Protection Act §43: Our ticketing flow follows the 票券定型化契約 tiered refund framework.
DMCA: Rights holders can submit takedown notices to our registered agent. See the DMCA policy.
We will never claim a certification we don't hold. Here's the honest current state:
For security issues, email security@jazznode.com.
For general privacy, compliance, or DPA requests, . A standard DPA is available at /legal/dpa.
For commercial / enterprise security questionnaires, include the word 'security questionnaire' in your subject line and we'll prioritize a response.